---
id: CVE-2026-32665
title: >-
  unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC
  client length (CVE-2026-32665)
summary: >-
  A flaw was found in Unbound when DNS-over-QUIC (DoQ) is enabled. An attacker
  could exploit improper validation of client-provided data length, leading to
  excessive memory allocation. This can cause the system to exceed its
  configured memor…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-770
  - CWE-1284
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - hardened_images
patched:
  - hardened_images
published: '2026-07-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T17:23:49+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32665.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32665.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-32665'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2503060'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-32665'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32665'
  - url: 'https://access.redhat.com/errata/RHSA-2026:43588'
  - url: 'https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32665.txt'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00285
epssPercentile: 0.20868
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-22T14:31:54.691586Z'
ingestedAt: '2026-09-16T14:57:28.057Z'
---

## Overview

A flaw was found in Unbound when DNS-over-QUIC (DoQ) is enabled. An attacker could exploit improper validation of client-provided data length, leading to excessive memory allocation. This can cause the system to exceed its configured memory limits for QUIC connections, resulting in a Denial of Service (DoS) for new DoQ clients.

## Vendor advisories

- **RHSA-2026:43588** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:43588)

**unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC client length** — rated Important by Red Hat. Released 2026-07-22, updated 2026-10-23.

Fixed:

- Red Hat Hardened Images

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:43588

Workarounds / mitigations:

- To mitigate this issue, disable DNS-over-QUIC (DoQ) in the Unbound configuration if it is not a required service. This can typically be achieved by commenting out or removing DoQ-related configuration options in `unbound.conf`. For example, remove or comment out lines such as `do-quic: yes` or `quic-port: 853`.

After modifying the configuration, restart the Unbound service for the changes to take effect:
```bash
systemctl restart unbound
```
Warning: Restarting the Unbound service will tempora…